Enable iOS plumbing for network security and add tests

[mehmetf]

This is a continuation of #20218. Copy pasted its description. This PR adds tests for the iOS code.

The feature is still disabled. We will enable it after the announcement is made.

Description

Starting API 28[1] and iOS 9[2], insecure connections are banned on native platform by default. Flutter, on the other hand, uses Dart VM's HTTP implementation which integrates with Sockets directly. This circumvents the security features on the platform and allows insecure connections.

We attempted to clamp the HTTP connections with a previous PR but this was deemed inadequate because it was ignoring platform level configuration leaving it up to users to allow insecure connections in Dart code via zones. (#17653).

This PR effectively reverts the aforementioned PR and replaces it with a new set of embedder configurations I have added to Dart VM via https://dart-review.googlesource.com/c/sdk/+/154180. With these new settings we can convert iOS and Android network configuration into Dart network configuration. This allows embedder to start the Dart isolate with an immutable network policy derived from the platform configuration.

Related Issues

flutter/flutter#54448

Tests

The biggest code change is how Android parses ApplicationInfo. Previously all this was scattered in the loader. I pulled it out and added parsing for the network configuration. I have added unit tests for these classes.

I would love to add a couple of end-to-end tests as well on Android and iOS but I am unsure how to do so. Please advise.

Checklist

Before you create this PR confirm that it meets all requirements listed below by checking the relevant checkboxes ([x]). This will ensure a smooth and quick review process.

• I read the contributor guide and followed the process outlined there for submitting PRs.
• I signed the CLA.
• I read and followed the C++, Objective-C, Java style guides for the engine.
• I read the tree hygiene wiki page, which explains my responsibilities.
• I updated/added relevant documentation.
• All existing and new tests are passing.
• I am willing to follow-up on review comments in a timely manner.

Breaking Change

Did any tests fail when you ran them? Please read handling breaking changes.

• No, no existing tests failed, so this is not a breaking change.
• Yes, this is a breaking change. If not, delete the remainder of this section.
  • Primary discussion at go/disable-http-flutter-dd and Ban HTTP by default in HttpClient dart-lang/sdk#40548.
  • I got input from the developer relations team, specifically from: @RedBrogdon
  • I wrote a migration guide: New breaking change: Network Policy on iOS and Android website#4458

[gaaclarke]

@mehmetf Heads up there is some work being done in Dart to get the network stack off of sockets: dart-lang/sdk#41376 (comment)

There are other issues like not respecting the operating system's VPN and proxy settings. It seems like if that gets implemented this work might be moot? I'm not sure what the schedule is for that work though.

[mehmetf]

Yes. When that happens, this (iOS) code can be deleted.

If I am reading this correctly though the "get off sockets" effort is primarily for Darwin? On Android, to obey the network policy, you would need to call out to Java layer. Android's network policy is odd in the sense that they don't actually control sockets. They control HTTP/WS stack and basically say: "Anyone who vends a custom implementation of HTTPConnection needs to obey OS's network policy". I suppose their assumption is that very few apps, if any, would deal with java.net.Socket directly on Android. I tried to make this multiplat (and in a sense, more secure) by pushing the checks on Android to socket level as well.

[mehmetf]

@xster Please take a look :)

[xster]

LGTM

[fluttergithubbot]

This pull request is not suitable for automatic merging in its current state.

• Please get at least one approved review before re-applying this label. Reviewers: If you left a comment approving, please use the "approve" review action instead.